Cookie Policy
Updated 23 September 2026 · Cookie consent revision 2026-09-23-ga4-attribution-2.
Current beta: Google Analytics starts only after you accept Analytics. Meta advertising measurement starts only after you accept Marketing.
Current settings
Account security, requested game features and preferences use essential storage. Google Analytics 4 loads only after explicit Analytics consent. It may then receive validated UTM source/medium/campaign labels and the referring site origin, without full referrer URLs or advertising click identifiers. Meta Pixel and Conversions API are enabled only with Marketing consent. A small cookie notice appears on your first visit. Cookie settings remains available in the home, pause menu and account panel.
Device storage inventory
| Item | Purpose | Duration |
|---|---|---|
| __Host-ardesia_session | Secure, HttpOnly login session; SameSite=Lax. | Seven days; sign-out invalidates access. |
| __Host-ardesia_csrf | Secure, HttpOnly protection against forged account requests. | 31449600 seconds (about one year), confirmed in the production response. |
| ardesia.account.offline.v2; ardesia.account.save.v2.*; ardesia.account.logout.v2; ardesia.account.identity-change | Requested offline continuation, pending save/setting sync, sign-out coordination. | No time-based expiry. Identity markers and older generations are cleaned during account transitions; cached saves may remain until removed or browser data is cleared. |
| ardesia.graphics.v1; ardesia.music.volume; ardesia.music.muted; engine user storage | Graphics/audio preferences and local game state. | Until changed, removed or browser site data is cleared. |
| ardesia-offline-map-v1-*; ardesia-offline-shell-v1-*; ardesia-offline-meta-v1; service worker | Game files and maps explicitly downloaded for offline use, not cached API responses. | Until replaced/cleaned by the download manager or browser storage is cleared; browser eviction may remove them earlier. |
| Session storage: ardesia.diagnostics.v1, ardesia.remote-diagnostics-session.v1 and pending map-allocation key | Technical recovery and duplicate allocation prevention; remote diagnostics only when requested. | Browser tab session, subject to browser restore behaviour; bounded diagnostic history. |
| ardesia.privacy.choice.v1 | Remembers this browser's choice and notice/service revision. | Six calendar months, then expires for consent decisions. Replaced when you change your choice. |
| _ga; _ga_CMQ1YVSRJK | Optional Google Analytics identifiers for visits and sessions, only after Analytics acceptance. | Configured expiry 180 days, without renewal on each page load. Removed by this site on withdrawal. Server-side retention is separate. |
| _fbp; _fbc | Optional Meta browser and ad click identifiers, only after Marketing consent. Removed on withdrawal. | Up to 90 days; browser and Meta SDK policies may shorten or renew this period. |
| __Host-ardesia_marketing | Secure, HttpOnly reference to this browser’s server-side marketing choice. Created only on acceptance; removed on withdrawal. | Up to 180 days. |
Inventory updated for the Web analytics and Meta integration on 23 September 2026; CSRF attributes were verified on 14 September 2026. The game engine can also store local files in browser-managed IndexedDB; clearing site data removes those files.
Optional services
Google Analytics and Meta/TikTok marketing are optional and have separate choices. A small notice at the bottom offers Accept all, Deny all and Settings. The notice remains visible until you choose. Continuing elsewhere on the page does not accept or reject optional cookies; Analytics and marketing remain off without a choice. Settings opens the three policy links and separate Analytics and Marketing choices. Accept all or selecting Analytics and saving enables Google Analytics. Deny all disables both categories. Selecting Marketing enables Meta Pixel/Conversions API and TikTok Pixel/Events API for visits, demo starts, registrations, checkout and confirmed purchases. Accept all covers only services actually enabled and listed at the time of your choice, never new services added later. Cookie settings lets you change or withdraw the choice. Any preference saved there is per browser/device and expires after six calendar months. If browser storage is blocked, the choice cannot be remembered. New optional services will require updated information and a new choice before activation.
Browser controls
You can also remove cookies and site storage through your browser settings. Doing so can sign you out and delete downloaded maps or unsynchronised local progress. Save and synchronise important progress first.
Contact: tommy@ardesia.world
TikTok and gameplay measurement
With Marketing consent, TikTok Pixel and Events API receive visits, demo starts, selected gameplay events, account registration, checkout and confirmed purchases to measure and improve advertising. Meta receives equivalent selected events. Gameplay data can include world, room number and type, enemy or hazard category, boss attempts, active-play milestones and exploration counts. These are game categories, not free-text messages. Engagement points are not money or purchase value.
Google Analytics receives usage events only with Analytics consent. Marketing and Analytics are separate choices in Settings; Accept all enables both and Deny all keeps both off. Adding TikTok requires a fresh choice. You can withdraw through Privacy choices or cookie settings. We do not send account passwords, emails, names, saved-game contents or checkout session URLs through these events.
TikTok may use _ttp, _tt_enable_cookie, ttclid and ttcsid-prefixed cookies after consent. Its advertising cookies can last up to 13 months from their last use. Ardesia stores a valid TikTok click identifier as ardesia_ttclid for up to 90 days and an essential, browser-scoped __Host-ardesia_tiktok permission receipt for up to six months. Withdrawing consent removes these first-party cookies on ardesia.world. Cookies on TikTok or Pangle domains are controlled by those services and can be managed in browser settings. Server attribution is retained up to two days; delivery receipts up to seven days. Revocation prevents new sends and clears pending payloads; it cannot recall events already delivered. TikTok may process data internationally under its applicable safeguards. See TikTok's privacy policy.